Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
Check Point VPN-1 SecuRemote/SecureClient Auto Local Logon Feature Lets Local Users Authenticate as Other Users
SecurityTracker Alert ID: 1019317|
SecurityTracker URL: http://securitytracker.com/id/1019317
(Links to External Site)
Updated: Feb 17 2008|
Original Entry Date: Feb 7 2008
User access via local system|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes |
Version(s): Secure Client NG AI R56, NGX R60|
A vulnerability was reported in VPN-1 SecuRemote/SecureClient in the Auto Local Logon feature. A local user can authenticate as the target user.|
The client stores authentication credentials in the Windows registry (subkey 'Credentials' in HKLM\Software\Checkpoint\SecuRemote). A local user can access the credentials to authenticate to the VPN as the target user.
The Windows-based clients are affected.
The vendor was notified on December 13, 2007.
MN Vasquez reported this vulnerability.
A local user can authenticate as the target user.|
The vendor has issued a fix (SecuRemote/SecureClient NGX R60 HFA_02 Supplement 2).|
The Check Point advisory is available at:
Vendor URL: supportcenter.checkpoint.com/supportcenter/PublicLoginRedirect.jsp?toURL=eventSubmit_doGoviewsolutiondetails=%26solutionid=sk34315 (Links to External Site)
Access control error|
|Underlying OS: Windows (Any)|
Source Message Contents
Date: Thu, 7 Feb 2008 10:44:14 -0700|
Subject: Checkpoint SecuRemote/Secure Client NGX Auto Local Logon Vulnerability
Bulletin Release 02.06.08
Checkpoint SecuRemote/Secure Client NGX Auto Local Logon Vulnerability
(Or, How to Be Bill Gates, if Bill Gates uses a CheckPoint VPN Client)
December 13, 2007
Vendor Release Date:
February 6, 2008
Impersonation of users. What's your VPN protecting?
Checkpoint says.... MEDIUM
VPN-1 SecuRemote/SecureClienetNGX R60 for Windows VPN-1
SecuRemote/SecureClient NGAI R56 for Windows Earlier versions may be
affected as well
Issues with credential storage in the registry allow anyone with read
access to the registry to utilize stored credentials to login and
impersonate the user who stored their credentials.
Sorry, no sexxy buffer overflow! However, you too can be an
authenticated VPN user!
Checkpoint's VPN client has an option to store credentials. All users
have read access to the registry key where these are stored. A user
can export this registry key, install the software, and configure it
to cache credentials. Then, import the registry and connect. No
prompting, and you are now the alternate user. Bad hacker, bad!
A user has enabled the Auto Local Logon option in the client, and
stored their credentials. These credentials are kept in the registry,
under HKLM\Software\Checkpoint\SecuRemote. Credentials are
specifically under the subkey named…. "Credentials"… sneaky!
Permissions for the Checkpoint key are set to Everyone – Full Control.
This means anyone with a local logon to the machine, or any
administrator from a remote machine, if remote registry access is
enabled, can view and export this key. Next step: Install the client
on another machine, and reboot as required. Configure Auto Local
Logon, and create a site, but provide no credentials. Import the key.
You are now the other person. Probably not Bill Gates, but still,
Disable the caching of credentials. Who's a fan of that anyway.
Alternately, see the vendor fix below.
Checkpoint has released a bulletin for this issue, at:
Good job, Check Point! Thanks for all the follow through, I'd work
with you guys again. Vendor timeline below.
<3 4 God, nothing else matters. Props to #13 Kurt Warner, Ron
Wolfley & Johnny Long, who "get it". Miss u dad.
BOC 4 lyfe!, 'sup to Debuc, Mekt, and jhs87. Thanks to the fam, & mom
Danielle - I love you!
Ang - I am so proud of you!
& hey. Can we get "Heroes" back on the air already? Kthx.
12.13.2007: Vendor notified via support portal
12.13.2007: Vendor escalated to security team
12.14.2007: Vendor requested more detail, detail provided
12.19.2007: Vendor confirmed and scheduled initial fix by 1.23.2008
1.16.2008: Vendor requested delay til ~2.4.2008
2.4.2008: Vendor confirmed release date of 2.5.2008 @ 4:00pm PST
2.5.2008: Vendor released bulletin on website, no customer notification
2.6.2006: Vendor reports they notified customers at 4:00PM PST
Copyright (c) 2008 Mike Vasquez
You can redistribute electronically, but don't edit it in any way
without the express permission of Mike Vasquez. Any reprint of this
alert, in whole or in part in any non-electronic medium must have
permission, email mnv at alumni dot princeton dot edu.
This alert may change without notice. Use of this info constitutes
acceptance for use AS IS. No warranties are implied or expressed. I'm
not liable for direct or indirect damages arising from the use or
distribution of this information. Use it at your own risk.
Go to the Top of This SecurityTracker Archive Page